Marco Franssen
4d3fb47839
pods like oidc mount more then one of these sockets, now we can control readonly vs non readonly better Signed-off-by: Marco Franssen <[email protected]> Signed-off-by: Marco Franssen <[email protected]>
52 lines
1.3 KiB
YAML
52 lines
1.3 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ include "spire.fullname" . }}-agent
|
|
namespace: {{ .Release.Namespace }}
|
|
data:
|
|
agent.conf: |
|
|
agent {
|
|
data_dir = "/run/spire"
|
|
log_level = "{{ .Values.spire.agent.logLevel }}"
|
|
server_address = "{{ include "spire.fullname" . }}-server"
|
|
server_port = "{{ .Values.server.service.port }}"
|
|
socket_path = "/run/spire/agent-sockets/agent.sock"
|
|
trust_bundle_path = "/run/spire/bundle/bundle.crt"
|
|
trust_domain = {{ .Values.spire.trustDomain | quote }}
|
|
}
|
|
|
|
plugins {
|
|
NodeAttestor "k8s_psat" {
|
|
plugin_data {
|
|
cluster = {{ .Values.spire.clusterName | quote }}
|
|
}
|
|
}
|
|
|
|
KeyManager "memory" {
|
|
plugin_data {
|
|
}
|
|
}
|
|
|
|
WorkloadAttestor "k8s" {
|
|
plugin_data {
|
|
# Defaults to the secure kubelet port by default.
|
|
# Minikube does not have a cert in the cluster CA bundle that
|
|
# can authenticate the kubelet cert, so skip validation.
|
|
skip_kubelet_verification = true
|
|
}
|
|
}
|
|
|
|
WorkloadAttestor "unix" {
|
|
plugin_data {
|
|
}
|
|
}
|
|
}
|
|
|
|
health_checks {
|
|
listener_enabled = true
|
|
bind_address = "0.0.0.0"
|
|
bind_port = "8080"
|
|
live_path = "/live"
|
|
ready_path = "/ready"
|
|
}
|